GCVE - cpe:2.3:a:debian:dpkg:1.15.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:debian:dpkg:1.15.9:*:*:*:*:*:*:*

part: a version: 1.15.9 update: *

Vendor	Debian (`4199fb5b-36f6-5ceb-83d5-855460345e36`)
Product	Dpkg (`70d9845d-a063-5593-86fb-6bada4efd00c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/dpkg`	purl2cpe	2026-06-01 10:17:13.901715
`pkg:deb/ubuntu/dpkg`	purl2cpe	2026-06-01 10:17:13.901717
`pkg:github/davidben/dpkg`	purl2cpe	2026-06-01 10:17:13.901718
`pkg:github/guillemj/dpkg`	purl2cpe	2026-06-01 10:17:13.901719
`pkg:rpm/fedora/dpkg`	purl2cpe	2026-06-01 10:17:13.901721
`pkg:rpm/opensuse/dpkg`	purl2cpe	2026-06-01 10:17:13.901722

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-3227`	vulnerable	2026-06-08 05:05:31.929078	Details available dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program. Published: 2014-05-30T18:00:00.000Z Updated: 2024-08-06T10:35:57.130Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2014/05/29/16 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746306 http://openwall.com/lists/oss-security/2014/04/29/4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3127`	vulnerable	2026-06-08 05:05:31.268364	Details available dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this can be considered a release engineering problem in the effort to fix CVE-2014-0471. Published: 2014-05-14T00:00:00.000Z Updated: 2024-08-06T10:35:57.031Z Open on db.gcve.eu Reference links https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746306 http://metadata.ftp-master.debian.org/changelogs//main/d/dpkg/dpkg_1.15.10_changelog http://seclists.org/oss-sec/2014/q2/191 http://seclists.org/oss-sec/2014/q2/227 http://www.securityfocus.com/bid/67181	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.